wuauserv high cpu usage

[srcoffee]

Similar to https://www.sysnative.com/forums/wi...sage-svchost-exe-wuauserv-update-culprit.html, I have a Windows Update Service gone rogue, consistently using 17% of my cpu unless I kill the service. I ran the SFCFix.exe utility and it found no corrupted files.

At approximately the same time this behavior began, applications began failing. Snagit and Dropbox both have failed. I have engaged tech support from both companies and they have so far been unable to diagnose what seems to be Windows issues. In the course of following their instructions, I have run a .Net fixit and update to v 4.6.1. Not sure if that's a good thing. I also discovered that dxdiag.exe will only run if I follow the prompt to exclude Direct3D.

In a long-standing and probably unrelated issue, I have a svchost.exe memory leak involving a different cluster of services that over the course of a couple of days will eat all my RAM. This PID includes Function Discovery, Font Cache, NSI, and several other services. I have not been able to isolate this problem as some of these services cannot be stopped. Anyway, i digress.

I seem to be unable to upload the CBS log. I suspect it is too large.

Any help appreciated.

 

[BrianDrab]

Hello and welcome

Due to the precise nature of your corruption, you will receive help from a user named LiquidTension. He's one of our senior trainees here who's in his final phrase of his studies and needs to gain some real world experience in specific areas of Windows Update. This means that he'll be assisting you, but that I will first need to double check and approve his fixes before he posts them to you. If anything this is a good thing for you because it means that you've got at least two of us watching over your thread, but it will unfortunately add a slight delay between each reply. I hope that you understand and can accept the need for us to train up new members in this way in order to carry on doing what we do here, however, if for any reason you object to this setup, I will happily take on your thread myself.

Thank you very much for your understanding. We'll be with you very shortly.

 

[srcoffee]

Sounds good. Thanks!

 

[LiquidTension]

Hello,

Please run the following diagnostic tool and attach the logs generated in your next reply.

Farbar Recovery Scan Tool (FRST) Scan

• Please download Farbar Recovery Scan Tool (x32) or Farbar Recovery Scan Tool (x64) and save the file to your Desktop.
• Note: Download and run the version compatible with your system (32 or 64-bit). Download both if you're unsure; only one will run.
• Right-click FRST.exe or FRST64.exe and select
  
  Run as administrator to run the programme.
• Click Yes to the disclaimer.
• Ensure the Addition.txt box is checked.
• Click the Scan button and let the programme run.
• Upon completion, click OK, then OK on the Addition.txt pop up screen.
• Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Attach both logs in your next reply.

 

[srcoffee]

Hello,

Please run the following diagnostic tool and attach the logs generated in your next reply.

I am attaching the logs.

Potentially embarrassing discovery: If I let the process run for several hours, it seems to eventually settle down. Is this perhaps normal behavior I am seeing?

 

[LiquidTension]

Hello,

Thank you for providing the logs.

Potentially embarrassing discovery: If I let the process run for several hours, it seems to eventually settle down. Is this perhaps normal behavior I am seeing?

This is not strictly normal behaviour, and something we can still investigate.

Referring to the following article, please perform a clean boot.
https://support.microsoft.com/en-gb/kb/929135

Whilst in this environment, please monitor your computer and let me know your findings.

 

[srcoffee]

I did a clean boot and there was no change in behavior: The svchost with the wuauserv ran 17% of cpu for an hour before I rebooted normally.

 

[LiquidTension]

Hello,

Please run Windows Update, check for and ensure all Critical/Important/Security updates are installed. Please confirm this in your next reply.

Afterwards, please execute the following batch file and provide the generated log.

Check Update Presence

• Press the Windows Key
  
  + r on your keyboard at the same time. Type Notepad and click OK.
• Copy the bold lines below and paste into the Notepad document:
  
  (
  wmic qfe get hotfixid | findstr /i /c:"KB3050265"
  wmic qfe get hotfixid | findstr /i /c:"KB3102810"
  ) >"%userprofile%\desktop\results.txt"
  del %0
  
  
• Click Format. Ensure Wordwrap is unchecked.
• Click File, Save As and name the file check.bat.
• Select All Files as the Save as type. Save the file to your Desktop.
• Locate check.bat
  
  on your Desktop. Right-click the file and click
  
  Run as administrator.
• Upon completion, a file (results.txt) will be created on your Desktop. Copy the contents of the file and paste in your next reply. If the file is empty, please let me know.

 

[srcoffee]

The results file is empty.

 

[LiquidTension]

Hello,

This indicates you do not have the the two updates installed. Before proceeding, it's important you confirm you have checked for and ensured all Critical/Important/Security updates are installed.

If so, please proceed by downloading the following standalone installers.
Download Update for Windows 7 for x64-based Systems (KB3050265) from Official Microsoft Download Center
Download Update for Windows 7 for x64-based Systems (KB3102810) from Official Microsoft Download Center

Initiate installation of KB3050265 and KB3102810, ensuring you reboot your computer inbetween and after installation.

In your next reply, please confirm you have all Critical/Important/Security updates installed, along with the two aforementioned optional updates. Please let me know if there is any change in the behaviour you are experiencing after installing the two updates.